CVE-2026-49993
MEDIUM
5,9
Source: [email protected]
Attack Vector: adjacent
Attack Complexity: high
Privileges Required: none
User Interaction: passive
Confidentiality: N/A
Integrity: N/A
Availability: N/A
Description
AI Translation Available
Nuxt is an open-source web development framework for Vue.js. In @nuxt/rspack-builder and @nuxt/webpack-builder from versions 3.15.4 to before 3.21.7 and 4.0.0 to before 4.4.7, there is an incomplete fix for GHSA-6m52-m754-pw2g. Source code may still be stolen during dev when using the webpack / rspack builder if the dev server is bound to a non-loopback address (e.g. nuxt dev --host) and the developer opens a malicious site on the same network. This issue has been patched in versions 3.21.7 and 4.4.7.
EPSS (Exploit Prediction Scoring System)
Trend Analysis
EPSS (Exploit Prediction Scoring System)
Prevede la probabilità di sfruttamento basata su intelligence sulle minacce e sulle caratteristiche della vulnerabilità.
EPSS Score
0,0002
Percentile
0,1th
Updated
EPSS Score Trend (Last 3 Days)
749
Exposed Dangerous Method or Function
IncompleteCommon Consequences
Security Scopes Affected:
Integrity
Confidentiality
Availability
Access Control
Other
Potential Impacts:
Gain Privileges Or Assume Identity
Read Application Data
Modify Application Data
Execute Unauthorized Code Or Commands
Other
Applicable Platforms
All platforms may be affected
https://github.com/nuxt/nuxt/security/advisories/GHSA-6m52-m754-pw2g
https://github.com/nuxt/nuxt/security/advisories/GHSA-x6qj-4h56-5rj5
https://github.com/nuxt/nuxt/commit/77187ee4015e9267fb464951542a3e09e8b5fa05
https://github.com/nuxt/nuxt/commit/e351de943e82db16970618b60dc7fdbaa58630f3
https://github.com/nuxt/nuxt/pull/35200
https://github.com/nuxt/nuxt/security/advisories/GHSA-6m52-m754-pw2g
https://github.com/nuxt/nuxt/security/advisories/GHSA-x6qj-4h56-5rj5